Which vulnerability database is kics using?

[Zebrawo]

Which vulnerability does KICS use? Is it like NIST NVD vulnerability database or something like this?
And is kics fetching the data from the database realtime? or are there any time delay?

[gabriel-cx]

Hi @Zebrawo ,

Thanks for your inputs!
KICS does not use any particular external vulnerability DB. Our 'vulnerabilities' information are provided by our internal AppSec team, and here you can check all of our queries that detect all those vulnerabilities.

Since our queries are present inside KICS itself, there is no delay "fetching" vulnerabilities information.

Hope this information clarifies your doubts.